Posted by x______________ 8 hours ago
Tell HN: Scribd Breached
Subject: Notice of Security Incident
This notice is being sent on behalf of Scribd, Inc., the parent company of Scribd, Slideshare, Everand, and Fable, by Epiq, Scribd Inc.’s notification partner.
Hello,
We are writing to let you know that Scribd, Inc. recently experienced a security incident that may have affected your data.
We detected that an unauthorized third party may have gained access to certain user data in one of our systems. After investigating this activity, we found that the third party may have accessed your email address and the following of your information: last 4 digits of your credit card and country, credit card issuer, credit card expiry date, payment history (not including credit card details).
We have no evidence that this data has been misused, but we are notifying you out of an abundance of caution so that you can take steps to protect your information.
Watch for phishing
We encourage you to stay vigilant for phishing attempts by bad actors pretending to be Scribd, Inc. or Scribd, Slideshare, Everand or Fable.
Remember that Scribd, Inc. will never ask you for your username and password or other sensitive information via email or text. If you did receive a message like that:
Don't click on any links in it. Instead type scribd.com, slideshare.net, everand.com, or fable.co directly into your browser.
Call us at: +1-877-361-9887. Hours of operation are Monday-Friday, 11:00 a.m.-11:00 p.m., Central European Time.
Report it through Scribd, Inc.'s Help Center.
We regret that this incident occurred and any concern it may cause you. If you have additional questions, contact the dedicated call center at +1-877-361-9887. Hours of operation are Monday-Friday, 11:00 a.m.-11:00 p.m. Central European Time.
The National Cyber Security Center has helpful guidance on how to recognize and avoid phishing scams here.
What Scribd, Inc. is doing
We have secured the affected system and ended the unauthorized access.
We have notified law enforcement as well as the relevant data protection authorities.
We are working with an expert third party cybersecurity firm to strengthen our access controls and monitoring.
Scribd, Inc.
Because nobody uses this cancer scam website lol.
Uploaders don't even get paid at all for views, it's just taking free labor and paywalling access to it, very similar to the infamous paid academic journals. But journals survive because they are an entrenched system that lives on prestige and hard-to-change academic bureaucracy. I really don't understand how Scribd, being an obvious scam and without those legacy advantages, can survive. I suppose hosting PDFs costs so little that a 0.001% of victims paying is enough to support it, but still, I don't understand why a free competitor hasn't come up to outrank it in searches and send it to oblivion where it belongs.
In retrospect, this was the correct way to proceed.
The docs I found were content, but nothing that could be used for its original purpose. Splurging a monthly subscription to find out sucked, but being breached and getting my info stolen is a kick in the ass.
Our saying so is in no way a pledge that we are good at security or diligent about anything but billing you."
I'm not saying everything can be secured easily, but a lot of those leaks recently could have been prevented easily.
They stated that they're doing a staggered rollout for email notifications which states at the beginning of October with other users reporting receiving the email yesterday[0].
Surely this is common? Surely?
Interestingly, that's not true. Homomorphic encryption can let you perform the same operations on encrypted data as on the plaintext, with the same results once decrypted. But it's vastly slower and less efficient - I know there are libraries like Microsoft SEAL but I've never seen anything that uses it in practice.
"If you have additional questions, contact the dedicated call center at +1-877-361-9887. Hours of operation are Monday-Friday, 11:00 a.m.-11:00 p.m. Central European Time."